github-actions

nektos/act

Test GitHub Actions on Your Laptop Before You Push — act parses .github/workflows files and runs them locally via Docker, matching GitHub's environment variables and filesystem so you get fast feedback without committing and pushing. It can also double as a task runner, letting workflow files replace a Makefile. A VS Code extension now lets you manage and run act without leaving your editor.

go-gitea/gitea

A self-hosted Git platform that can reuse GitHub Actions — Gitea bundles Git hosting, issue tracking, wiki, package registry and CI/CD into one self-hosted service, written in Go so it runs on nearly any platform. CI workflows can reuse GitHub Actions, making it a practical option for teams wanting full control over their code infrastructure without vendor lock-in.

fastapi/full-stack-fastapi-template

A batteries-included FastAPI + React starter with Cloud deploy option — A GitHub template combining FastAPI, SQLModel, PostgreSQL, React, Vite, Tailwind CSS and shadcn/ui, with JWT auth, email recovery, Pytest/Playwright tests and GitHub Actions CI/CD. It bundles optional FastAPI Cloud deployment alongside Docker Compose, making it useful for developers who want a ready-to-clone full-stack boilerplate.

goreleaser/goreleaser

GoReleaser expands release automation beyond Go to Rust, Zig, Python — GoReleaser automates building, packaging, and publishing software releases, cutting out manual steps in CI/CD. While rooted in Go, it now also supports Rust, Zig, TypeScript, and Python projects, making it useful for teams releasing across multiple languages who want a single consistent workflow.

cobusgreyling/loop-engineering

Practical patterns, starters & CLI tools for loop engineering with AI coding agents. Design systems that prompt and orchestrate agents (inspired by Addy Osmani and Boris Cherny). Includes loop-audit, loop-init, loop-cost.

zizmorcore/zizmor

Catching Dangerous CI/CD Misconfigurations Before They Ship — zizmor scans GitHub Actions, Dependabot, and pre-commit configs for real security flaws: template injection, credential leakage, excessive permissions, and impostor commits. Backed by sponsors like Trail of Bits, it's a fast Rust-based tool for teams wanting to audit and fix CI/CD pipelines before attackers do.

actions/actions-runner-controller

Autoscaling GitHub Actions runners natively on Kubernetes — ARC is a Kubernetes operator that manages self-hosted GitHub Actions runners as runner scale sets, scaling them up or down based on workflow demand. Runners can be ephemeral containers, enabling fast, clean scaling. Useful for teams running CI/CD on their own Kubernetes clusters instead of GitHub-hosted runners.

github/gh-aw

Write AI-driven GitHub Actions workflows in plain Markdown — gh-aw is a GitHub CLI extension that compiles Markdown+YAML workflow files into standard GitHub Actions, letting agents like Copilot, Claude Code, Codex, Gemini or Pi handle issue triage, PR review, or CI investigation. Agent jobs run read-only and sandboxed, with writes going through permission-scoped safe-outputs jobs for safer automation.

aquasecurity/trivy-action

Trivy Scanning Baked Into Your GitHub Actions Pipeline — This official GitHub Action wraps Trivy to scan container images, filesystems, Git repos, IaC configs, and private registries, and can also generate SBOMs. It integrates directly with GitHub Code Scanning, making it a quick way to add vulnerability checks and fail CI builds on findings without installing Trivy manually.

suzuki-shunsuke/pinact

Pinning GitHub Actions to commit SHAs, including reusable workflows — pinact rewrites GitHub Actions workflow and composite action files to pin tags to full commit SHAs with version comments, and can update or verify those pins. Notably it covers reusable workflow calls, which GitHub's new native workflow lockfiles still don't pin, making it a useful complement for securing CI supply chains.

yalongwastaken/git-koi

Draw a pixel-art koi from a GitHub account's public activity, as a looping GIF for a profile README.

github/gh-actions-lock

Pin every GitHub Action to a verified commit with a lockfile — An official gh CLI extension from GitHub that scans workflows, pins every action dependency to an exact commit SHA, and re-verifies locked pins on each run. Built for teams hardening CI against supply-chain tampering; currently in public preview with an evolving lockfile format.

winnin/farol

A risk map for pull requests, sitting after your AI reviewer — farol is a free CLI and GitHub Action that runs after AI code review to show approvers which files carry the real risk of a merge, what they reach, diff coverage, and contract breaks. It relies on static analysis rather than model guesses, covering TypeScript/React, Go, and Python, and runs in shadow mode so it never blocks merges.

tmatens/compose-lint

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CIS Docker Benchmark.

necoz-oss/changelog-bot

AI changelog generator that opens PRs for you, no API key required — changelog-bot turns commit history, PR titles, and release notes into a ready-to-ship changelog entry, optionally opening a PR with compare links already wired up. It works with OpenAI or Anthropic for tone-aware summaries, but falls back to a heuristic generator if no API key is set, so releases never fail because AI is down. Ships as a CLI, GitHub Action, or reusable workflow.

karamage/pr-risk-score

Risk-score pull requests 0-100 so humans only review the risky ones. Explainable deterministic baseline + bounded AI semantic review. Claude Code skill & GitHub Action.

karamage/goodhart

Your coding agent says the tests pass. Did it fix the code, or the tests? Catches AI agents skipping tests, deleting assertions and neutering CI. Claude Code plugin + GitHub Action + CLI.

karamage/overfit

The tests pass. Would the code work for an input the tests never tried? Catches AI agents hard-coding test values, detecting the test runner and reading fixtures. Claude Code plugin + GitHub Action + CLI.